atreyabain/nodejs-fm
1
0
Fork 0
Code Issues Pull Requests Wiki Activity

Fix sandboxing(#2)

Browse Source
This commit is contained in:
Atreya Bain
2019-05-24 11:25:10 +05:30
parent 29de9a63f9
commit e39c28539e
3 changed files with 5 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
index.js
View File

@@ -44,7 +44,8 @@ let inDir = (dircheck,dirmain) => !path.relative(path.normalize(dircheck), dirma
app.post('/files/ls',(req,res,next)=>{ app.post('/files/ls',(req,res,next)=>{
const location = processing.mergedir(req.body.loc,settings) const location = processing.mergedir(req.body.loc,settings)
const nloc = path.normalize(req.body.loc); //const nloc = path.normalize(req.body.loc);
const nloc = path.normalize(path.relative(settings.dirname,location))
//Make sure not escaping the given path; insecure //Make sure not escaping the given path; insecure
if(inDir(settings.dirname,location)){ if(inDir(settings.dirname,location)){
fs.readdir(location,{withFileTypes:true},(err,files)=>{ fs.readdir(location,{withFileTypes:true},(err,files)=>{

2
processing.js
View File

@@ -12,7 +12,7 @@ module.exports.dirprocess = (dirstream,location,settings)=>{
{ {
contents.push({ contents.push({
"name":element.name, "name":element.name,
"path":path.normalize(path.join(location,element.name)) , "path":path.relative(settings.dirname,path.normalize(path.join(location,element.name))) ,
"isDir": element.isDirectory() "isDir": element.isDirectory()
}) })
} }

3
test.js
View File

@@ -18,7 +18,8 @@ describe('Page Status',()=>{
it('POST /files/ls the home page',(done)=>{ it('POST /files/ls the home page',(done)=>{
chai.request(testScript).post('/files/ls').send({'loc':'/'}).end((err,res)=>{ chai.request(testScript).post('/files/ls').send({'loc':'/'}).end((err,res)=>{
res.should.have.status(200) res.should.have.status(200)
res.body.should.have.property('loc').eql('/') res.body.should.have.property('loc').eql('.')
res.body.should.have.property('back').eql(null) res.body.should.have.property('back').eql(null)
//TODO: MAKE SURE JSON FILE //TODO: MAKE SURE JSON FILE
done() done()